#!/sbin/openrc-run
# K3s agent (worker node). Env vars K3S_URL + K3S_TOKEN come from cloud-init
# user-data — the orchestrator embeds them at RunInstances time per the
# Nodegroup bootstrap flow (eks-v1.md Q14).
#
# K3S_URL points at the cluster's NLB endpoint (https://{cluster}.{account}
# .eks.{region}.{suffix}:443) so the agent join path stays stable across the
# v2 HA migration (single-VM v1 → 3-node etcd quorum v2). No AMI rebuild
# needed when the control plane expands.

description="K3s Kubernetes agent (Mulga EKS worker)"
command="/usr/local/bin/k3s"
command_args="agent"
command_background="yes"
pidfile="/run/k3s-agent.pid"
output_log="/var/log/k3s-agent.log"
error_log="/var/log/k3s-agent.log"

start_stop_daemon_args="--wait 5000"

depend() {
    need net cgroups
    after firewall
}

start_pre() {
    # Cloud-init drops these into /etc/spinifex-eks/agent.env. We source them
    # here so OpenRC injects them into k3s' environment.
    if [ -f /etc/spinifex-eks/agent.env ]; then
        # shellcheck disable=SC1091
        . /etc/spinifex-eks/agent.env
        export K3S_URL K3S_TOKEN K3S_NODE_NAME
    fi
    if [ -z "${K3S_URL:-}" ] || [ -z "${K3S_TOKEN:-}" ]; then
        eerror "K3S_URL and K3S_TOKEN must be set in /etc/spinifex-eks/agent.env"
        return 1
    fi

    # Stamp the node providerID as aws:///<az>/<instance-id> (EKS parity) so the
    # AWS Load Balancer Controller can resolve nodes as EC2 instances for ip-mode
    # target registration; k3s' default k3s://<name> providerID makes it reject
    # the node. Instance-id + AZ come from IMDSv2 (token-gated GET). On any miss
    # we leave the default providerID rather than block the agent from starting.
    _imds=http://169.254.169.254/latest
    _curl="curl -fsS --connect-timeout 3 --max-time 5"
    _tok=$(${_curl} -X PUT -H 'X-aws-ec2-metadata-token-ttl-seconds: 120' \
        "${_imds}/api/token" 2>/dev/null)
    if [ -n "${_tok}" ]; then
        _iid=$(${_curl} -H "X-aws-ec2-metadata-token: ${_tok}" \
            "${_imds}/meta-data/instance-id" 2>/dev/null)
        _az=$(${_curl} -H "X-aws-ec2-metadata-token: ${_tok}" \
            "${_imds}/meta-data/placement/availability-zone" 2>/dev/null)
        if [ -n "${_iid}" ] && [ -n "${_az}" ]; then
            command_args="agent --kubelet-arg=provider-id=aws:///${_az}/${_iid}"
        else
            ewarn "IMDS instance-id/az empty; keeping default providerID"
        fi
    else
        ewarn "IMDS token request failed; keeping default providerID"
    fi
}